Deepfakes & Synthetic Media

In 2019, the CEO of a UK energy provider received a phone call from his boss at the German parent company. The voice was unmistakable—the slight German accent, the cadence, the urgency. He requested an immediate transfer of €220,000 to a supplier. The CEO complied. Here is the key insight: He was not speaking to his boss. He was speaking to an AI.

This UAE bank heist scenarioUAE bank heist scenario demonstrated that deepfakes are no longer just a novelty for swapping faces in movies. They are a mature vector for fraud. We have moved from an era where "seeing is believing" to one where our senses can be deceived by widely available technology. To govern risk in this environment, we must understand not just how these illusions are made, but how they erode the foundation of organizational trust.

You might wonder how a computer can generate such convincing fakes. Originally, this relied on Generative Adversarial Networks (GANs). Think of it as a game between two AIs: a "forger" tries to create a fake image, and a "detective" tries to spot the fake. They play millions of rounds until the forger becomes so skilled that the detective cannot tell the difference.

Today, the technology is even more efficient. Modern voice cloning tools require surprisingly little data. As we saw with the Biden robocall incidentBiden robocall incident, just a few seconds of clear audio—captured from a podcast or a voicemail greeting—can be enough to clone a voice and make it say anything.

The danger of deepfakes is not just that we might believe a lie. It is that we might stop believing the truth. We call this the Liar's Dividend. When the public knows that any video or recording could be faked, it becomes easy for bad actors to dismiss genuine evidence of misconduct as "just AI."

To understand the scale of this disruption, consider the viral image of Pope Francis in a puffer jacketPope Francis in a puffer jacket. While harmless, it bypassed our critical filters because it looked visually consistent with reality. In a business context, this ambiguity complicates everything. If a video surfaces of your CEO making offensive remarks, proving it is fake takes time—and by then, the reputational damage may be done.

A common question from leaders is, "Can't we just buy software to detect the fakes?" You can, but there is a fundamental problem: it is an asymmetric arms race. The defenders need to be right every time, but the attackers only need to succeed once. Furthermore, every time a detection tool improves, deepfake creators use that very tool to train their models to beat it.

Because we cannot rely solely on detection, the industry is moving toward provenance. This means proving where content came from, rather than analyzing what it looks like. The leading standard is C2PAC2PA, which acts like a digital "nutrition label" cryptographically embedded in a file. It tells you who created the image and whether it has been altered.

Since we cannot trust our eyes and ears as implicitly as we used to, we must update our human protocols. Technical solutions are necessary but insufficient. You need robust verification protocolsverification protocols for high-stakes interactions.

Think of it this way: If you receive an urgent request for a wire transfer, do not rely on the voice on the phone. Establish a "challenge-response" culture where employees are encouraged to hang up and call back on a verified number, or use a pre-arranged safe word. Governance in the age of synthetic media is less about analyzing pixels and more about verifying identity through multiple secure channels.